dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sec(glauth): rotate serviceaccount passsha256; scrub retired plaintext from comments (mxaccessgw SEC-36)

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-07 09:18:05 -04:00
parent 5198d3dc7f
commit aada53b27a
3 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/glauth/README.md
+8 -4
View File
@@ -20,7 +20,9 @@ each app maps only its own family and ignores the rest.
| `Gw*` (561x) | MxGateway dashboard (config-mapped) | GwAdmin 5610, GwReader 5611 |
| `OtOpcUa-*` (57xx) | OtOpcUa AdminUI (DB-mapped) | Admins 5701, Designers 5702, Viewers 5703 |
**Users** (all password `password` except `serviceaccount` → `serviceaccount123`):
**Users** (all password `password` except `serviceaccount`, whose password is rotated out-of-band —
SEC-36 — and is **not** recorded in this repo; it lives only in the `passsha256` below and each
app's secret store):
- **`serviceaccount`** (`cn=serviceaccount,dc=zb,dc=local`) — the single bind account every app
uses for search-then-bind. Has a `search *` capability.
@@ -51,11 +53,13 @@ ssh dohertj2@10.100.0.35 'cd ~/zb-glauth && docker compose up -d --force-recreat
## Verify
Bind as the service account and confirm `multi-role` spans all four families:
Bind as the service account and confirm `multi-role` spans all four families. Substitute the
current service-account password (rotated out-of-band, SEC-36 — take it from the consuming app's
secret store, e.g. the gateway's `MxGateway:Ldap:ServiceAccountPassword`):
```bash
ldapsearch -x -H ldap://10.100.0.35:3893 \
-D cn=serviceaccount,dc=zb,dc=local -w serviceaccount123 \
-D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
-b dc=zb,dc=local "(cn=multi-role)" memberOf
# → result: 0 Success. memberOf comes back as group DNs (e.g. ou=SCADA-Admins,ou=groups,dc=zb,dc=local)
# spanning all four families: SCADA-*, ReadOnly/Write*/AlarmAck, GwAdmin/GwReader, OtOpcUa-*.
@@ -75,7 +79,7 @@ No `ldapsearch` locally? Run it from a throwaway container:
```bash
docker run --rm alpine:3.20 sh -c 'apk add -q openldap-clients >/dev/null 2>&1 && \
ldapsearch -x -H ldap://10.100.0.35:3893 -D cn=serviceaccount,dc=zb,dc=local -w serviceaccount123 \
ldapsearch -x -H ldap://10.100.0.35:3893 -D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
-b dc=zb,dc=local "(cn=multi-role)" memberOf'
```